 iceBear67
|
c7afb86ebc
|
harden build scripts and fix correctness issues from audit
Security & correctness fixes following the audit in REPORT.md.
- setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
check failures properly, return valid exit codes, and fetch
/releases/latest (arch-aware) instead of the possibly-draft .[0]
- entrypoint.sh: quote "$@" and build --net conditionally so empty
NET_INTERFACE/NET_MAC don't yield "tap=,mac="
- image-updater: replace tight 3s retry loop with capped exponential
backoff + periodic pull instead of hammering the registry
- sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
- vm.Dockerfile: copy only host private keys at mode 600 instead of
the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
- Makefile: stop generating redundant _pub key files
- build-image.sh: detect failure via alpine-make-vm-image's real exit
status rather than grepping stdout for "ERROR"
- remove orphaned etc/alloy/config.alloy (service not installed)
- README: correct data.raw path
- add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
|
2026-07-14 17:52:24 +08:00 |
|
|
iceBear67
|
dcbc6e17cb
|
fix: change image-updater to be oneshot unit
|
2026-07-09 00:13:58 +08:00 |
|
|
iceBear67
|
be27cdba97
|
introduce image-updater
|
2026-07-09 00:04:25 +08:00 |
|
|
iceBear67
|
c6ce5f676e
|
add alloy
|
2026-07-08 22:30:48 +08:00 |
|
|
iceBear67
|
06ad25f8e7
|
fix: tsdns startup creates multiple container
|
2026-07-06 14:31:07 +08:00 |
|
|
iceBear67
|
18a68ee6fd
|
fix: multiple tsdns containers are created
|
2026-07-06 14:24:38 +08:00 |
|
|
iceBear67
|
3e4a23f402
|
set TS_HOSTNAME for tsdns
|
2026-07-05 19:03:13 +08:00 |
|
|
iceBear67
|
ea638786d6
|
fix: tsdns init script
|
2026-07-05 19:01:00 +08:00 |
|
|
iceBear67
|
bf67b8b95f
|
refactor
|
2026-07-05 13:49:09 +08:00 |
|
|
iceBear67
|
33638a5c0a
|
fix: wrong copyspec for bubble executables
|
2026-06-22 15:00:57 +08:00 |
|